{
  "head": {
    "vars": [
      "query_def_tech_label",
      "top_def_tech_label",
      "def_tactic_label",
      "def_tactic_rel_label",
      "def_tech_label",
      "def_artifact_rel_label",
      "def_artifact_label",
      "off_artifact_label",
      "off_artifact_rel_label",
      "off_tech_label",
      "off_tech_id",
      "off_tech_parent_label",
      "off_tech_parent_is_toplevel",
      "off_tactic_rel_label",
      "off_tactic_label",
      "def_tactic",
      "def_tactic_rel",
      "def_tech",
      "def_artifact_rel",
      "def_artifact",
      "off_artifact",
      "off_artifact_rel",
      "off_tech",
      "off_tech_parent",
      "off_tactic_rel",
      "off_tactic"
    ]
  },
  "results": {
    "bindings": [
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TokenBinding"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TokenBinding"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TokenBinding"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TokenBinding"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "NTDS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TokenBinding"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TokenBinding"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TokenBinding"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TokenBinding"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1539"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1142"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Cookies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TokenBinding"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TokenBinding"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TokenBinding"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TokenBinding"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Environment"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Environment"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy Environment"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "manages"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Decoy Artifact"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Decoy Artifact"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Information Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1082"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyEnvironment"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#manages"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyArtifact"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyArtifact"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1082"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Parent PID Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asynchronous Procedure Call"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Doppelg\u00e4nging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Window Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Service Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Information Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1082"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1082"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Time Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1124"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1124"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1057"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1057"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Control Panel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compiled HTML File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Parent PID Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asynchronous Procedure Call"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Doppelg\u00e4nging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Parent PID Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Parent PID Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Parent PID Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asynchronous Procedure Call"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asynchronous Procedure Call"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asynchronous Procedure Call"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Doppelg\u00e4nging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Doppelg\u00e4nging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Doppelg\u00e4nging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Window Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Window Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Window Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Service Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Service Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Service Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Information Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1082"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1082"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Information Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1082"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1082"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Information Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1082"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1082"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Time Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1124"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1124"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Time Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1124"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1124"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Time Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1124"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1124"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1057"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1057"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1057"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1057"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1057"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1057"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Subroutine"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stored Procedure"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Subroutine"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Control Panel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Control Panel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Control Panel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compiled HTML File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compiled HTML File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compiled HTML File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Parent PID Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Parent PID Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Parent PID Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asynchronous Procedure Call"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asynchronous Procedure Call"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asynchronous Procedure Call"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Doppelg\u00e4nging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Doppelg\u00e4nging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Doppelg\u00e4nging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Consistency Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Access Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1531"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Access Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1531"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Network Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreNetworkAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Network Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreNetworkAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Network Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreNetworkAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "NTDS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1539"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1142"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Cookies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Network Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreNetworkAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Network Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Delete Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreNetworkAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Network Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Revert Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreNetworkAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Desktop Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Service Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1563"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SSH"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Lateral Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1570"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Access Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1219"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1219"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Symmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Fronting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Obfuscation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Stage Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1104"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1104"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Fallback Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encoding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1132"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1132"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1102"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1102"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1095"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1095"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mail Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-hop Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Transfer Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ingress Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1105"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1105"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Protocol Tunneling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1572"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1572"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Standard Port"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1571"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1571"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Reflection Amplification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Endpoint Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Direct Network Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transmitted Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Browser Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1185"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1185"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trusted Relationship"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1199"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "RPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kerberoasting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Exfiltration"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1020"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1020"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Transfer Size Limits"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1030"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1030"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1029"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1029"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Cloud Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Unencrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Other Network Medium"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Remote Terminal Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Access Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1531"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HomoglyphDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HomoglyphDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HomoglyphDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HomoglyphDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "URL Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URLReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "URL Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URLAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HomoglyphDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Identifier Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Identifier"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IdentifierActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Identifier"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HomoglyphDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "URL Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URLReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "URL Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URLAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Identifier Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Identifier"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IdentifierActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Identifier"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HomoglyphDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "URL Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URLReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "URL Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URLAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Identifier Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Identifier"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IdentifierActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Identifier"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HomoglyphDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "URL Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URLReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "URL Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URLAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Identifier Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Identifier"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IdentifierActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Identifier"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firewall"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Network Device Firewall"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firewall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Delete Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Revert Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Access Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1531"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Biometric Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "NTDS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1539"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1142"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Cookies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reissue Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReissueCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Access Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1531"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Format Conversion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Message Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Message Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Sender Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SenderReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Message Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Message Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Sender MTA Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SenderMTAReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Message Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Message Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Sender Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SenderReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Message Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Message Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Sender MTA Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SenderMTAReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Message Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Message Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Sender Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SenderReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Message Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Message Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Sender MTA Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SenderMTAReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Message Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Message Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Sender Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SenderReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Message Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Message Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Sender MTA Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SenderMTAReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "installs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Replication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1091"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1091"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Image File Execution Options Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Elevated Execution with Prompt"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Communication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1092"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1092"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Inhibit System Recovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1490"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1490"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Audio Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Audio Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1123"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AudioInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1123"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Video Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Video Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1125"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VideoInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Digital Camera"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Video Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1125"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DigitalCamera"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1025"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1025"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Keyboard Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keylogging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "queries"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Language Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1614.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Location Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#queries"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1614.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1614"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Query Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Write Protection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Secondary Storage"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Storage"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Storage Object Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1619"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedWriteProtection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SecondaryStorage"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudStorage"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1619"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Storage"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Storage Object Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1619"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudStorage"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1619"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disk Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Storage"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Storage"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Storage Object Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1619"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiskEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Storage"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudStorage"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1619"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Time Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-run"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-run"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Image File Execution Options Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "IIS Components"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Bootloader Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "authenticates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootloaderAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Add-ins"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Add-ins"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Add-ins"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Browser Extension"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1176"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BrowserExtension"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1176"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stored Procedure"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Client Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Host Software Binary"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1554"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ClientApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1554"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Registry"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1112"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistry"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1112"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Software Dependencies and Development Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1195.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Supply Chain Compromise"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Replication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1091"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1091"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Hardware Supply Chain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1195.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Supply Chain Compromise"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Software Supply Chain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1195.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Supply Chain Compromise"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "connects"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hardware Additions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1200"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#connects"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1200"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "installs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials in Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Security Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Interception"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1111"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SecurityToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1111"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Keyboard Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keylogging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Elevated Execution with Prompt"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MMC"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MMC"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "runs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Compiler"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#runs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden File System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disk Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Storage"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Storage"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden File System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiskEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Storage"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Storage"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Bootloader Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "authenticates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootloaderAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Registry"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1112"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistry"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1112"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Time Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-run"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-run"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration over USB"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1052.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Physical Medium"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1052.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1052"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Replication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1091"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1091"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Communication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1092"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1092"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Audio Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Audio Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1123"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AudioInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1123"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Video Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Video Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1125"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VideoInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Digital Camera"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Video Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1125"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DigitalCamera"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1025"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1025"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Keyboard Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keylogging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Storage"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Storage Object Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1619"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudStorage"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1619"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Replication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1091"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1091"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Hardware Supply Chain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1195.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Supply Chain Compromise"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "connects"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hardware Additions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1200"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#connects"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1200"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Security Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Interception"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1111"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SecurityToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1111"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Keyboard Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keylogging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration over USB"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1052.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Physical Medium"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1052.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1052"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Desktop Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Service Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1563"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SSH"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Lateral Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1570"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Access Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1219"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1219"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Symmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Fronting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Obfuscation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Stage Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1104"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1104"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Fallback Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encoding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1132"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1132"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "DNS Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "DNS Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "DNS Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "DNS Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "DNS Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "DNS Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1102"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1102"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1095"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1095"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mail Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-hop Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Transfer Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ingress Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1105"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1105"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Protocol Tunneling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1572"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1572"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Standard Port"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1571"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1571"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Reflection Amplification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Endpoint Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Direct Network Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transmitted Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Browser Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1185"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1185"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trusted Relationship"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1199"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "RPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kerberoasting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Exfiltration"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1020"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1020"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Transfer Size Limits"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1030"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1030"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1029"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1029"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Cloud Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Unencrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Other Network Medium"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Remote Terminal Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Image File Execution Options Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Elevated Execution with Prompt"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "queries"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Language Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1614.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Location Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#queries"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1614.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1614"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Query Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Image File Execution Options Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Add-ins"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Registry"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1112"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistry"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1112"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials in Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Elevated Execution with Prompt"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MMC"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden File System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Configuration Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Registry"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1112"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistry"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1112"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Desktop Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Desktop Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Desktop Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Desktop Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Desktop Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Desktop Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Desktop Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Service Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1563"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Service Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1563"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Service Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1563"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Service Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1563"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Service Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1563"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Service Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1563"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Service Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1563"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SSH"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SSH"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SSH"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SSH"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SSH"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SSH"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SSH"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Lateral Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1570"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Lateral Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1570"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Lateral Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1570"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Lateral Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1570"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Lateral Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1570"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Lateral Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1570"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Lateral Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1570"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Lateral Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1570"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Carving"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File Transfer Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Lateral Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1570"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileCarving"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileTransferNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Access Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1219"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1219"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Access Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1219"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1219"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Access Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1219"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1219"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Access Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1219"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1219"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Access Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1219"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1219"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Access Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1219"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1219"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Access Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1219"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1219"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Access Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1219"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1219"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Symmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Symmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Symmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Symmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Symmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Symmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Symmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Symmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Fronting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Fronting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Fronting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Fronting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Fronting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Fronting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Fronting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Fronting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Obfuscation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Obfuscation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Obfuscation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Obfuscation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Obfuscation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Obfuscation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Obfuscation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Obfuscation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Stage Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1104"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1104"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Stage Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1104"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1104"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Stage Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1104"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1104"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Stage Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1104"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1104"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Stage Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1104"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1104"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Stage Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1104"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1104"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Stage Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1104"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1104"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Stage Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1104"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1104"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Fallback Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Fallback Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Fallback Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Fallback Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Fallback Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Fallback Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Fallback Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Fallback Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encoding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1132"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1132"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encoding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1132"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1132"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encoding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1132"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1132"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encoding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1132"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1132"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encoding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1132"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1132"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encoding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1132"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1132"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encoding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1132"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1132"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encoding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1132"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1132"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "DNS Traffic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSTrafficAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "DNS Traffic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSTrafficAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1102"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1102"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1102"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1102"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1102"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1102"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1102"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1102"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1102"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1102"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1102"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1102"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1102"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1102"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1102"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1102"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1095"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1095"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1095"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1095"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1095"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1095"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1095"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1095"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1095"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1095"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1095"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1095"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1095"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1095"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1095"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1095"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mail Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mail Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mail Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mail Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mail Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mail Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mail Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mail Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-hop Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-hop Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-hop Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-hop Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-hop Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-hop Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-hop Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-hop Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Transfer Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Transfer Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Transfer Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Transfer Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Transfer Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Transfer Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Transfer Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Carving"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File Transfer Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Transfer Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileCarving"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileTransferNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Transfer Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ingress Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1105"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1105"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ingress Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1105"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1105"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ingress Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1105"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1105"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ingress Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1105"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1105"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ingress Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1105"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1105"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ingress Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1105"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1105"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ingress Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1105"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1105"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ingress Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1105"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1105"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Protocol Tunneling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1572"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1572"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Protocol Tunneling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1572"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1572"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Protocol Tunneling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1572"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1572"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Protocol Tunneling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1572"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1572"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Protocol Tunneling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1572"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1572"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Protocol Tunneling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1572"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1572"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Protocol Tunneling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1572"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1572"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Protocol Tunneling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1572"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1572"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Standard Port"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1571"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1571"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Standard Port"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1571"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1571"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Standard Port"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1571"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1571"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Standard Port"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1571"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1571"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Standard Port"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1571"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1571"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Standard Port"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1571"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1571"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Standard Port"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1571"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1571"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Standard Port"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1571"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1571"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Inbound Session Volume Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Reflection Amplification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundSessionVolumeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Reflection Amplification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Reflection Amplification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Reflection Amplification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Reflection Amplification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Reflection Amplification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Reflection Amplification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Reflection Amplification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Inbound Session Volume Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundSessionVolumeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Inbound Session Volume Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Endpoint Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundSessionVolumeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Endpoint Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Endpoint Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Endpoint Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Endpoint Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Endpoint Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Endpoint Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Endpoint Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Inbound Session Volume Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Direct Network Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundSessionVolumeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Direct Network Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Direct Network Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Direct Network Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Direct Network Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Direct Network Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Direct Network Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Direct Network Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transmitted Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transmitted Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transmitted Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transmitted Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transmitted Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transmitted Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transmitted Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Browser Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1185"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1185"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Browser Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1185"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1185"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Browser Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1185"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1185"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Browser Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1185"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1185"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Browser Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1185"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1185"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Browser Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1185"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1185"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Browser Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1185"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1185"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "DNS Traffic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "may-contain"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "DNS Lookup"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DNS Lookup"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Sniffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1040"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSTrafficAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-contain"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSLookup"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSLookup"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1040"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "IPC Traffic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IPCTrafficAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Inbound Session Volume Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundSessionVolumeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Inbound Session Volume Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundSessionVolumeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Inbound Session Volume Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundSessionVolumeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trusted Relationship"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1199"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trusted Relationship"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1199"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trusted Relationship"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1199"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trusted Relationship"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1199"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trusted Relationship"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1199"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trusted Relationship"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1199"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trusted Relationship"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1199"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trusted Relationship"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1199"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "DNS Traffic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "may-contain"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "DNS Lookup"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DNS Lookup"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Sniffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1040"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSTrafficAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-contain"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSLookup"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSLookup"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1040"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "RPC Traffic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "RPC Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "RPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kerberoasting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RPCTrafficAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "RPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kerberoasting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "RPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kerberoasting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "RPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kerberoasting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "RPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kerberoasting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "RPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kerberoasting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "RPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kerberoasting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "RPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kerberoasting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "IPC Traffic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IPCTrafficAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Exfiltration"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1020"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1020"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Exfiltration"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1020"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1020"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Exfiltration"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1020"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1020"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Exfiltration"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1020"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1020"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Exfiltration"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1020"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1020"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Exfiltration"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1020"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1020"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Exfiltration"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1020"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1020"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Transfer Size Limits"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1030"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1030"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Transfer Size Limits"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1030"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1030"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Transfer Size Limits"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1030"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1030"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Transfer Size Limits"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1030"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1030"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Transfer Size Limits"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1030"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1030"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Transfer Size Limits"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1030"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1030"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Transfer Size Limits"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1030"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1030"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1029"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1029"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1029"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1029"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1029"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1029"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1029"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1029"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1029"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1029"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1029"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1029"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1029"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1029"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Cloud Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Cloud Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Cloud Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Cloud Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Cloud Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Cloud Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Cloud Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Cloud Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Unencrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Unencrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Unencrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Unencrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Unencrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Unencrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Unencrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Unencrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Other Network Medium"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Other Network Medium"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Other Network Medium"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Other Network Medium"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Other Network Medium"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Other Network Medium"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Other Network Medium"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Remote Terminal Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Remote Terminal Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Remote Terminal Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Remote Terminal Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Remote Terminal Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Protocol Command Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Remote Terminal Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationProtocolCommandAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Remote Terminal Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Remote Terminal Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Connected Honeynet"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Environment"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy Environment"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "manages"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Decoy Artifact"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Decoy Artifact"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Information Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1082"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyEnvironment"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#manages"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyArtifact"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyArtifact"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1082"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Desktop Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Service Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1563"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SSH"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Lateral Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1570"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Access Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1219"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1219"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Symmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Fronting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Obfuscation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Stage Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1104"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1104"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Fallback Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encoding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1132"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1132"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1102"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1102"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1095"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1095"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mail Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-hop Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Transfer Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ingress Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1105"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1105"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Protocol Tunneling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1572"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1572"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Standard Port"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1571"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1571"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Reflection Amplification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Endpoint Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Direct Network Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transmitted Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Browser Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1185"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1185"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trusted Relationship"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1199"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "RPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kerberoasting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Exfiltration"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1020"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1020"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Transfer Size Limits"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1030"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1030"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1029"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1029"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Cloud Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Unencrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Other Network Medium"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Client-server Payload Profiling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Remote Terminal Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Integrated Honeynet"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Environment"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy Environment"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "manages"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Decoy Artifact"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Decoy Artifact"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Information Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1082"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyEnvironment"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#manages"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyArtifact"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyArtifact"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1082"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Domain Trust Policy"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Domain Trust Policy"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainTrustPolicy"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File Section"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Resource Fork"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Resource Forking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileFormatVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileSection"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ResourceFork"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File Section"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Resource Fork"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Resource Forking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileFormatVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileSection"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ResourceFork"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "NTDS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1539"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1142"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Cookies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "installs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Image File Execution Options Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Elevated Execution with Prompt"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Providers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Setuid and Setgid"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SID-History Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Startup Directory"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Startup Items"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Authentication Package"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Change Default File Association"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Monitors"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Support Provider"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain or Tenant Policy Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1484"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1484"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ShimDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Winlogon Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Inhibit System Recovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1490"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1490"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Inhibit System Recovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1490"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1490"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Code Repository"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Code Repositories"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1213.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data from Information Repositories"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CodeRepository"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Forwarding Rule"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Service Dashboard"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1538"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1538"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Location Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1614"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1614"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Software Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1518.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Software Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firewall Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Software Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1518.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Software Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirewallConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "queries"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Language Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1614.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Location Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#queries"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1614.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1614"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Service Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1526"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1526"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Query Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Group Policy Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1615"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1615"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Time Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-run"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-run"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Home Page"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Image File Execution Options Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Providers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "IIS Components"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Startup Directory"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Startup Items"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Authentication Package"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Change Default File Association"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Conditional Access Policies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Add-ins"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Add-ins"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Add-ins"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Browser Extension"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1176"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BrowserExtension"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1176"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Test"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Monitors"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Support Provider"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ShimDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stored Procedure"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Client Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Host Software Binary"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1554"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ClientApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1554"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Winlogon Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Registry"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1112"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistry"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1112"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Software Dependencies and Development Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1195.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Supply Chain Compromise"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Software Supply Chain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1195.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Supply Chain Compromise"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "installs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "MacOS Keychain"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MacOSKeychain"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials in Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password Store"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordStore"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Conditional Access Policies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Instance Metadata"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Instance Metadata API"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudInstanceMetadata"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "In-memory Password Store"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#In-memoryPasswordStore"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Password Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemPasswordDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "In-memory Password Store"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Securityd Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#In-memoryPasswordStore"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Group Policy Preferences"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Password Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemPasswordDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Elevated Execution with Prompt"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Control Panel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Setuid and Setgid"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Cloud Firewall"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SID-History Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MMC"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MMC"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "runs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Compiler"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#runs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Instance Metadata"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudInstanceMetadata"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden File System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Conditional Access Policies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firewall Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify System Firewall"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirewallConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Cloud Resource Hierarchy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1666"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1666"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Environment Variable"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessEnvironmentVariable"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Registry Key"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistryKey"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email Rule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email Rule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Permissions Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1222"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1222"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Instance Metadata"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Delete Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudInstanceMetadata"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SIP and Trust Provider Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1553.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Subvert Trust Controls"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1553.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1553"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Cloud Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Instance Metadata"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Revert Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudInstanceMetadata"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain or Tenant Policy Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1484"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1484"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Configurations"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Safe Mode Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable Windows Event Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration Component"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable Windows Event Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationComponent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Registry"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1112"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistry"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1112"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Time Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-run"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-run"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Parent PID Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asynchronous Procedure Call"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Doppelg\u00e4nging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Window Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Service Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Information Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1082"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1082"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Time Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1124"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1124"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1057"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1057"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Control Panel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compiled HTML File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Parent PID Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asynchronous Procedure Call"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Doppelg\u00e4nging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Setuid and Setgid"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SID-History Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain or Tenant Policy Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1484"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1484"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Group Policy Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1615"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1615"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Conditional Access Policies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Conditional Access Policies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Group Policy Preferences"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Setuid and Setgid"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SID-History Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Conditional Access Policies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Permissions Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1222"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1222"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain or Tenant Policy Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1484"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1484"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Startup Directory"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Startup Items"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Privilege Escalation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1068"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1068"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Session Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserSessionInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemDaemonMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Scheduled Job Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Job Schedule"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Job Schedule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJobAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemDaemonMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Hollowing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Input Device Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Input Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Audio Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Audio Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1123"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDeviceAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AudioInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1123"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential API Hooking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Input Device Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Input Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Video Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Video Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1125"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDeviceAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VideoInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Input Device Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Input Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Keyboard Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keylogging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDeviceAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Startup Directory"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Startup Items"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Session Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserSessionInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemDaemonMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Embedded Monitoring Code"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareEmbeddedMonitoringCode"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Behavior Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareBehaviorAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Scheduled Job Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Job Schedule"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Job Schedule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJobAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemDaemonMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Embedded Monitoring Code"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareEmbeddedMonitoringCode"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Behavior Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareBehaviorAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Embedded Monitoring Code"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareEmbeddedMonitoringCode"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Behavior Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareBehaviorAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Client Execution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1203"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1203"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemDaemonMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Scheduled Job Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Job Schedule"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Job Schedule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJobAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemDaemonMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential API Hooking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Input Device Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Input Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Keyboard Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keylogging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDeviceAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Windows Event Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Windows Event Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Defense Evasion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1211"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1211"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Embedded Monitoring Code"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareEmbeddedMonitoringCode"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Behavior Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareBehaviorAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Command History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Command History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Embedded Monitoring Code"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareEmbeddedMonitoringCode"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Behavior Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareBehaviorAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemDaemonMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firewall"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Network Device Firewall"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firewall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Scheduled Job Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Job Schedule"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Job Schedule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Masquerade Task or Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJobAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Delete Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Revert Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Hollowing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Safe Mode Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Session Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserSessionInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Embedded Monitoring Code"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareEmbeddedMonitoringCode"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Behavior Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareBehaviorAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Embedded Monitoring Code"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareEmbeddedMonitoringCode"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Behavior Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareBehaviorAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Directory"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Startup Directory"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Startup Items"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Directory"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Directory"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Directory"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Directory"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Directory"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Startup Directory"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Startup Items"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Directory"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Directory"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Directory"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Directory"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firewall"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Network Device Firewall"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firewall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Delete Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Revert Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Sender MTA Reputation Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Message Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Sender MTA Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SenderMTAReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Sender MTA Reputation Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Message Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Sender MTA Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SenderMTAReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Sender MTA Reputation Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Message Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Sender MTA Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SenderMTAReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Sender MTA Reputation Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Message Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Sender MTA Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SenderMTAReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Activity Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Identifier Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Identifier"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IdentifierActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Identifier"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Activity Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Identifier Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Identifier"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IdentifierActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Identifier"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Activity Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Identifier Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Identifier"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IdentifierActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Identifier"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Activity Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Identifier Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Identifier"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IdentifierActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Identifier"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Physical Access Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Physical Access Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Video Surveillance"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Digital Camera"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Digital Camera"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Video Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1125"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VideoSurveillance"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DigitalCamera"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DigitalCamera"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Windows Event Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Command History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegmentVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Privilege Escalation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1068"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegmentVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1068"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Hollowing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegmentVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential API Hooking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegmentVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Client Execution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1203"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegmentVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1203"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegmentVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential API Hooking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegmentVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Defense Evasion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1211"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegmentVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1211"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Hollowing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegmentVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Disk Partitioning"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disk Partitioning"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Partition Table"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Partition Table"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disk Structure Wipe"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1561.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Disk Wipe"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiskPartitioning"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PartitionTable"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PartitionTable"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1561.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1561"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Disk Partitioning"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disk Partitioning"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Partition Table"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Partition Table"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disk Content Wipe"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1561.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Disk Wipe"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiskPartitioning"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PartitionTable"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PartitionTable"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1561.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1561"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Disk Partitioning"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disk Formatting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Secondary Storage"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Storage"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Storage Object Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1619"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiskFormatting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SecondaryStorage"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudStorage"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1619"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "URL Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "URL Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URLAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "URL Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "URL Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URLAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "URL Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "URL Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URLAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "URL Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "URL Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URLAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Firmware Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Firmware Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Firmware Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Firmware Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Firmware Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Firmware Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Firmware Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Electromagnetic Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Replication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1091"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1091"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Electromagnetic Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Communication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1092"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1092"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Electromagnetic Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Audio Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Audio Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1123"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AudioInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1123"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Electromagnetic Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Video Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Video Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1125"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VideoInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Electromagnetic Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Digital Camera"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Video Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1125"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DigitalCamera"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Electromagnetic Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1025"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1025"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Electromagnetic Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Keyboard Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keylogging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Electromagnetic Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Storage"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Storage Object Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1619"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudStorage"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1619"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Electromagnetic Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Replication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1091"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1091"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Electromagnetic Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Hardware Supply Chain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1195.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Supply Chain Compromise"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Electromagnetic Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "connects"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hardware Additions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1200"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#connects"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1200"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Electromagnetic Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Security Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Interception"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1111"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SecurityToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1111"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Electromagnetic Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Keyboard Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keylogging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Electromagnetic Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration over USB"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1052.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Physical Medium"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1052.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1052"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Source Code Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Source Code Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Domain Logic Validation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "validates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Subroutine"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stored Procedure"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainLogicValidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#validates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Subroutine"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Source Code Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Source Code Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Variable Initialization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Subroutine"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stored Procedure"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VariableInitialization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Subroutine"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Source Code Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Source Code Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Scrubbing"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Subroutine"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stored Procedure"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialScrubbing"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Subroutine"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Source Code Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Source Code Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Trusted Library"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Subroutine"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stored Procedure"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TrustedLibrary"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Subroutine"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Providers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Setuid and Setgid"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SID-History Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Startup Directory"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Startup Items"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Authentication Package"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Change Default File Association"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Monitors"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Support Provider"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain or Tenant Policy Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1484"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1484"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ShimDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Winlogon Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Inhibit System Recovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1490"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1490"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Forwarding Rule"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Service Dashboard"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1538"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1538"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Location Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1614"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1614"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Software Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1518.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Software Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firewall Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Software Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1518.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Software Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirewallConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Service Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1526"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1526"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Group Policy Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1615"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1615"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Home Page"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Providers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Startup Directory"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Startup Items"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Authentication Package"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Change Default File Association"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Conditional Access Policies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Test"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Monitors"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Support Provider"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ShimDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Winlogon Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Conditional Access Policies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Instance Metadata"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Instance Metadata API"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudInstanceMetadata"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Group Policy Preferences"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Control Panel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Setuid and Setgid"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Cloud Firewall"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SID-History Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Instance Metadata"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudInstanceMetadata"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Conditional Access Policies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firewall Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify System Firewall"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirewallConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Cloud Resource Hierarchy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1666"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1666"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Environment Variable"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessEnvironmentVariable"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Registry Key"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistryKey"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email Rule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email Rule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Permissions Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1222"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1222"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Instance Metadata"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Delete Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudInstanceMetadata"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SIP and Trust Provider Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1553.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Subvert Trust Controls"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1553.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1553"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Cloud Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Instance Metadata"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Revert Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudInstanceMetadata"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain or Tenant Policy Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1484"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1484"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Configurations"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Safe Mode Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable Windows Event Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Configuration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration Component"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable Windows Event Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreConfiguration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationComponent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Kernel-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File Section"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Resource Fork"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Resource Forking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileFormatVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileSection"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ResourceFork"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File Section"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Resource Fork"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Resource Forking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileFormatVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileSection"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ResourceFork"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Image File Execution Options Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Elevated Execution with Prompt"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Code Repository"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Code Repositories"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1213.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data from Information Repositories"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CodeRepository"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "queries"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Language Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1614.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Location Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#queries"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1614.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1614"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Query Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Image File Execution Options Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Add-ins"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Registry"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1112"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistry"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1112"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "MacOS Keychain"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MacOSKeychain"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials in Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password Store"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordStore"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "In-memory Password Store"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#In-memoryPasswordStore"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Password Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemPasswordDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "In-memory Password Store"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Securityd Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#In-memoryPasswordStore"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Password Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemPasswordDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Elevated Execution with Prompt"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MMC"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden File System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Database"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Registry"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1112"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreDatabase"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistry"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1112"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "NTDS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1539"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1142"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Cookies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Access Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1531"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Access Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1531"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreUserAccountAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore User Account Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Creation Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Creation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileCreationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Creation Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Creation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compiled HTML File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileCreationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Subroutine"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stored Procedure"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Subroutine"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application-based Process Isolation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Magic Byte Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Stack Frame Canary Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Stack Frame Canary Validation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "validates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrameCanaryValidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#validates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Stack Frame Canary Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Stack Frame Canary Validation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "validates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Privilege Escalation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1068"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrameCanaryValidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#validates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1068"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Stack Frame Canary Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Stack Frame Canary Validation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "validates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Client Execution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1203"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrameCanaryValidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#validates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1203"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Stack Frame Canary Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Stack Frame Canary Validation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "validates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrameCanaryValidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#validates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Stack Frame Canary Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Stack Frame Canary Validation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "validates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Defense Evasion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1211"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrameCanaryValidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#validates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1211"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Privilege Escalation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1068"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1068"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Hollowing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential API Hooking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Client Execution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1203"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1203"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential API Hooking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mavinject"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Defense Evasion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1211"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1211"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Reflective Code Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1620"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1620"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Hollowing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Dynamic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Sender Reputation Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Message Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Sender Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SenderReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Sender Reputation Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Message Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Sender Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SenderReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Sender Reputation Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Message Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Sender Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SenderReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Sender Reputation Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Message Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Sender Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SenderReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Vulnerability Assessment"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "System Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Vulnerability Assessment"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Digital System"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Legacy System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Downgrade Attack"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemVulnerabilityAssessment"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DigitalSystem"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LegacySystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "DNS Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "DNS Traffic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSTrafficAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "DNS Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "DNS Traffic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSTrafficAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "DNS Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "DNS Traffic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "may-contain"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "DNS Lookup"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DNS Lookup"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Sniffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1040"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSTrafficAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-contain"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSLookup"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSLookup"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1040"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "DNS Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "DNS Traffic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "may-contain"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "DNS Lookup"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DNS Lookup"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Sniffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1040"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSTrafficAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-contain"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSLookup"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSLookup"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1040"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Active Physical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Active Physical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Active Physical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Active Physical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Active Physical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firewall"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Network Device Firewall"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firewall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Active Physical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Delete Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Active Physical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Revert Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "RF Shielding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Replication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1091"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1091"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "RF Shielding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Communication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1092"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1092"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "RF Shielding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Audio Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Audio Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1123"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AudioInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1123"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "RF Shielding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Video Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Video Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1125"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VideoInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "RF Shielding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Digital Camera"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Video Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1125"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DigitalCamera"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "RF Shielding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1025"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1025"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "RF Shielding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Keyboard Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keylogging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "RF Shielding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Storage"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Storage Object Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1619"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudStorage"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1619"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "RF Shielding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Replication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1091"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1091"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "RF Shielding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Hardware Supply Chain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1195.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Supply Chain Compromise"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "RF Shielding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "connects"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hardware Additions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1200"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#connects"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1200"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "RF Shielding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Security Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Interception"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1111"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SecurityToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1111"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "RF Shielding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Keyboard Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keylogging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "RF Shielding"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration over USB"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1052.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Physical Medium"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1052.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1052"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Shadow Stack Comparisons"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ShadowStackComparisons"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegmentVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Elevated Execution with Prompt"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Parent PID Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Parent PID Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ptrace System Calls"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Shadow Stack Comparisons"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Privilege Escalation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1068"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ShadowStackComparisons"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1068"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Privilege Escalation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1068"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegmentVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1068"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asynchronous Procedure Call"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asynchronous Procedure Call"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Doppelg\u00e4nging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Doppelg\u00e4nging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Hollowing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegmentVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Local Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential API Hooking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegmentVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get Screen Capture"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screen Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1113"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetScreenCapture"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1113"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get System Network Config Value"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemNetworkConfigValue"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Window Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get Open Windows"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Window Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetOpenWindows"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Window Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get Running Processes"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Software Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1518.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Software Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetRunningProcesses"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Service Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get Running Processes"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Service Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetRunningProcesses"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Service Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Information Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1082"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1082"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Information Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1082"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1082"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Socket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateSocket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Copy Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CopyToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get System Config Value"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemConfigValue"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get Open Sockets"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Connections Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1049"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetOpenSockets"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1049"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Time Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1124"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1124"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get System Time"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Time Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1124"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemTime"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1124"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Time Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1124"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1124"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get System Config Value"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Query Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemConfigValue"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1057"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1057"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get Running Processes"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1057"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetRunningProcesses"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1057"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1057"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1057"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get System Time"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemTime"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Database Query String Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Query"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database Query"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "injects"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseQueryStringAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseQuery"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseQuery"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#injects"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Shadow Stack Comparisons"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Client Execution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1203"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ShadowStackComparisons"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1203"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Client Execution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1203"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegmentVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1203"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Native API"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1106"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1106"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Shadow Stack Comparisons"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ShadowStackComparisons"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegmentVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential API Hooking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegmentVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Read File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReadFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Thread"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mavinject"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateThread"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Elevated Execution with Prompt"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Control Panel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Control Panel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compiled HTML File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compiled HTML File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compiled HTML File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Parent PID Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Parent PID Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ptrace System Calls"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Shadow Stack Comparisons"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Defense Evasion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1211"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ShadowStackComparisons"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1211"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Defense Evasion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1211"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegmentVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1211"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asynchronous Procedure Call"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asynchronous Procedure Call"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Doppelg\u00e4nging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Doppelg\u00e4nging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Code Segment Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Hollowing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegmentVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Move File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MoveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Local Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get System Time"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemTime"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Decompression Checking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "DNS Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "DNS Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "DNS Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "DNS Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Inbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Inbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Inbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Inbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Reflection Amplification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Inbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Inbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Inbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Inbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Inbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Inbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Endpoint Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Inbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Inbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Inbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Direct Network Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Inbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Inbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Inbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Inbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Inbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Inbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Inbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Inbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Inbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Inbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Inbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Inbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Desktop Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Service Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1563"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SSH"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Lateral Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1570"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Access Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1219"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1219"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Symmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Fronting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Obfuscation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Stage Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1104"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1104"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Fallback Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encoding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1132"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1132"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1102"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1102"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1095"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1095"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mail Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-hop Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Transfer Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ingress Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1105"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1105"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Protocol Tunneling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1572"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1572"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Standard Port"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1571"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1571"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Reflection Amplification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Endpoint Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Direct Network Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transmitted Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Browser Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1185"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1185"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trusted Relationship"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1199"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "RPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kerberoasting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Exfiltration"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1020"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1020"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Transfer Size Limits"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1030"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1030"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1029"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1029"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Cloud Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Unencrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Other Network Medium"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Community Deviation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Remote Terminal Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficCommunityDeviation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Forwarding Rule"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "configures"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Forwarding Rule"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DisableRemoteAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#configures"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Environment Variable"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessEnvironmentVariable"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "configures"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Environment Variable"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DisableRemoteAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#configures"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessEnvironmentVariable"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "configures"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DisableRemoteAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#configures"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email Rule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email Rule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "configures"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email Rule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DisableRemoteAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#configures"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "configures"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email Rule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DisableRemoteAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#configures"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable Windows Event Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "configures"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable Windows Event Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DisableRemoteAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#configures"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Performance Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Performance Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Performance Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Performance Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Performance Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Performance Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Performance Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Performance Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Performance Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Performance Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Performance Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Performance Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Performance Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Performance Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Windows Event Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Performance Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Performance Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Command History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Performance Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Performance Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Performance Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Exception Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationExceptionMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Log"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Desktop Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Service Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1563"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SSH"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Lateral Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1570"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Access Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1219"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1219"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Symmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Fronting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Obfuscation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Stage Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1104"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1104"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Fallback Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encoding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1132"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1132"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1102"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1102"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1095"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1095"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mail Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-hop Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Transfer Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ingress Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1105"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1105"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Protocol Tunneling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1572"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1572"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Standard Port"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1571"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1571"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Reflection Amplification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Endpoint Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Direct Network Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transmitted Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Browser Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1185"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1185"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trusted Relationship"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1199"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "RPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kerberoasting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Exfiltration"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1020"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1020"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Transfer Size Limits"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1030"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1030"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1029"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1029"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Cloud Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Unencrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Other Network Medium"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Remote Terminal Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Setuid and Setgid"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SID-History Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain or Tenant Policy Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1484"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1484"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Access Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1531"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Group Policy Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1615"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1615"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Conditional Access Policies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Conditional Access Policies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Group Policy Preferences"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Setuid and Setgid"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SID-History Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Conditional Access Policies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Permissions Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1222"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1222"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain or Tenant Policy Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1484"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1484"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Content Rules"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Session Init Config Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Session Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserSessionInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Session Init Config Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Session Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserSessionInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Session Init Config Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Session Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserSessionInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Firmware Embedded Monitoring Code"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Embedded Monitoring Code"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareEmbeddedMonitoringCode"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Firmware Embedded Monitoring Code"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Embedded Monitoring Code"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareEmbeddedMonitoringCode"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Firmware Embedded Monitoring Code"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Embedded Monitoring Code"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareEmbeddedMonitoringCode"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Firmware Embedded Monitoring Code"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Embedded Monitoring Code"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareEmbeddedMonitoringCode"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Firmware Embedded Monitoring Code"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Embedded Monitoring Code"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareEmbeddedMonitoringCode"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Firmware Embedded Monitoring Code"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Embedded Monitoring Code"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareEmbeddedMonitoringCode"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Firmware Embedded Monitoring Code"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Embedded Monitoring Code"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareEmbeddedMonitoringCode"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Metadata Value Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Access Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1531"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Stack Frame Canary Validation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "validates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrameCanaryValidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#validates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Stack Frame Canary Validation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "validates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Privilege Escalation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1068"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrameCanaryValidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#validates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1068"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Privilege Escalation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1068"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1068"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Privilege Escalation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1068"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1068"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Hollowing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Hollowing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential API Hooking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential API Hooking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "configures"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Forwarding Rule"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DisableRemoteAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#configures"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Forwarding Rule"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Stack Frame Canary Validation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "validates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Client Execution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1203"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrameCanaryValidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#validates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1203"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Client Execution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1203"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1203"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Client Execution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1203"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1203"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Stack Frame Canary Validation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "validates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrameCanaryValidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#validates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential API Hooking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential API Hooking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mavinject"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mavinject"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Stack Frame Canary Validation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "validates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Defense Evasion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1211"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrameCanaryValidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#validates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1211"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Defense Evasion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1211"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1211"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Defense Evasion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1211"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1211"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "configures"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Environment Variable"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DisableRemoteAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#configures"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessEnvironmentVariable"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Environment Variable"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessEnvironmentVariable"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "configures"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DisableRemoteAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#configures"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "configures"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email Rule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DisableRemoteAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#configures"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "configures"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email Rule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DisableRemoteAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#configures"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email Rule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email Rule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Reflective Code Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1620"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1620"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Reflective Code Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1620"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1620"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Hollowing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Segment Address Offset Randomization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Hollowing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "configures"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable Windows Event Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DisableRemoteAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#configures"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable Windows Event Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Email Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Email Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Email Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Email Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Parent PID Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asynchronous Procedure Call"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Doppelg\u00e4nging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Window Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Service Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Information Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1082"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1082"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Time Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1124"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1124"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1057"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1057"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Control Panel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compiled HTML File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Parent PID Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asynchronous Procedure Call"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Doppelg\u00e4nging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Execution Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Executable Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Passive Certificate Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Passive Certificate Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Passive Certificate Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Passive Certificate Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Passive Certificate Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Passive Certificate Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Email Removal"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Removal"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRemoval"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Email Removal"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Removal"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRemoval"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Email Removal"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Removal"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRemoval"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Email Removal"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Removal"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRemoval"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Email Removal"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Removal"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRemoval"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Email Removal"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Removal"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRemoval"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Reputation Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "URL Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URLReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Reputation Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "URL Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URLReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Reputation Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "URL Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URLReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Identifier Reputation Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "URL Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URLReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Passive Logical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Passive Logical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Passive Logical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Passive Logical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Passive Logical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firewall"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Network Device Firewall"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firewall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Passive Logical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Delete Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Passive Logical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Revert Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HomoglyphDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HomoglyphDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HomoglyphDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HomoglyphDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HomoglyphDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HomoglyphDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HomoglyphDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Homoglyph Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HomoglyphDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Session"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "RDP Session"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Desktop Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Session"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RDPSession"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Session"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Session"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Service Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1563"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Session"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteSession"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Session"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "SSH Session"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SSH Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1563.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Service Session Hijacking"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Session"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SSHSession"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Session"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "RDP Session"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RDP Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1563.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Service Session Hijacking"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Session"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RDPSession"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Session"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "SSH Session"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SSH"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Session"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SSHSession"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Session"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Login Session"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Session"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LoginSession"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Session"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Session"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1133"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Session"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkSession"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1133"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Session"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Session"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1133"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Session"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkSession"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1133"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Session"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Login Session"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trusted Relationship"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1199"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Session"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LoginSession"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Suspension"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "suspends"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Session"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Login Session"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Session"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LoginSession"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "NTDS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1539"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1142"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Cookies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Elevated Execution with Prompt"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Parent PID Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ptrace System Calls"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asynchronous Procedure Call"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Doppelg\u00e4nging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Local Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get Screen Capture"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screen Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1113"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetScreenCapture"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1113"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get System Network Config Value"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemNetworkConfigValue"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get Open Windows"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Window Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetOpenWindows"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Window Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get Running Processes"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Software Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1518.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Software Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetRunningProcesses"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get Running Processes"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Service Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetRunningProcesses"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Service Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Information Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1082"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1082"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Socket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateSocket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Copy Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CopyToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get System Config Value"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemConfigValue"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get Open Sockets"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Connections Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1049"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetOpenSockets"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1049"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get System Time"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Time Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1124"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemTime"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1124"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Time Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1124"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1124"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get System Config Value"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Query Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemConfigValue"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get Running Processes"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1057"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetRunningProcesses"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1057"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1057"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1057"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get System Time"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemTime"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Native API"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1106"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1106"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Read File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReadFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Thread"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mavinject"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateThread"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Elevated Execution with Prompt"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Control Panel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compiled HTML File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compiled HTML File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Parent PID Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ptrace System Calls"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asynchronous Procedure Call"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Doppelg\u00e4nging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Move File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MoveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Local Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get System Time"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemTime"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Access Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1531"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Active Certificate Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Active Certificate Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Active Certificate Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Active Certificate Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Active Certificate Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Active Certificate Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Token-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Token-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Token-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Token-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Access Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1531"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Token-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Token-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Token-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Token-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Token-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Token-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Token-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Token-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Setuid and Setgid"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SID-History Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain or Tenant Policy Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1484"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1484"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Access Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1531"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Group Policy Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1615"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1615"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Conditional Access Policies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Conditional Access Policies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Group Policy Preferences"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Setuid and Setgid"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SID-History Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Conditional Access Policies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Permissions Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1222"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1222"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain or Tenant Policy Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1484"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1484"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Operational Activity Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Access Modeling"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Startup Directory"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Startup Items"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Startup Directory"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Startup Items"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Safe Mode Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Inbound Session Volume Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Inbound Session Volume Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Reflection Amplification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundSessionVolumeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Inbound Session Volume Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Inbound Session Volume Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundSessionVolumeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Inbound Session Volume Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Inbound Session Volume Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Endpoint Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundSessionVolumeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Inbound Session Volume Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Inbound Session Volume Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Direct Network Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundSessionVolumeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Inbound Session Volume Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Inbound Session Volume Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundSessionVolumeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Inbound Session Volume Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Inbound Session Volume Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundSessionVolumeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Inbound Session Volume Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Inbound Session Volume Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundSessionVolumeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "installs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Inhibit System Recovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1490"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1490"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Time Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-run"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-run"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "IIS Components"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Add-ins"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Add-ins"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Browser Extension"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1176"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BrowserExtension"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1176"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stored Procedure"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Client Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Host Software Binary"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1554"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ClientApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1554"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Software Dependencies and Development Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1195.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Supply Chain Compromise"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Software Supply Chain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1195.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Supply Chain Compromise"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "installs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MMC"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "runs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Compiler"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#runs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Software"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Time Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-run"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-run"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Elevated Execution with Prompt"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Parent PID Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ptrace System Calls"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asynchronous Procedure Call"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Doppelg\u00e4nging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Local Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get Screen Capture"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screen Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1113"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetScreenCapture"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1113"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get System Network Config Value"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemNetworkConfigValue"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get Open Windows"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Window Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetOpenWindows"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Window Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get Running Processes"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Software Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1518.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Software Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetRunningProcesses"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get Running Processes"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Service Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetRunningProcesses"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Service Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Information Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1082"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1082"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Socket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateSocket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Copy Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CopyToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get System Config Value"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemConfigValue"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get Open Sockets"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Connections Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1049"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetOpenSockets"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1049"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get System Time"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Time Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1124"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemTime"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1124"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Time Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1124"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1124"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get System Config Value"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Query Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemConfigValue"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get Running Processes"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1057"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetRunningProcesses"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1057"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1057"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1057"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get System Time"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemTime"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Native API"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1106"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1106"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Read File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReadFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Thread"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mavinject"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateThread"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Elevated Execution with Prompt"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Control Panel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compiled HTML File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compiled HTML File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Parent PID Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ptrace System Calls"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asynchronous Procedure Call"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Doppelg\u00e4nging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Move File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MoveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Local Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get System Time"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemTime"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Desktop Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Service Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1563"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SSH"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Lateral Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1570"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Access Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1219"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1219"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Symmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Fronting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Obfuscation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Stage Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1104"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1104"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Fallback Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encoding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1132"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1132"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1102"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1102"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1095"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1095"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mail Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-hop Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Transfer Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ingress Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1105"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1105"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Protocol Tunneling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1572"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1572"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Standard Port"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1571"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1571"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Reflection Amplification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Endpoint Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Direct Network Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transmitted Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Browser Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1185"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1185"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trusted Relationship"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1199"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "RPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kerberoasting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Exfiltration"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1020"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1020"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Transfer Size Limits"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1030"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1030"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1029"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1029"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Cloud Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Unencrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Other Network Medium"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote Terminal Session Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Remote Terminal Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteTerminalSessionDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Directory"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Startup Directory"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Startup Items"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Directory"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Access Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1531"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Domain Trust Policy"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainTrustPolicy"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Directory"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Directory"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Directory"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Directory"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Startup Directory"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Startup Items"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Directory"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Directory"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Directory"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Directory"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Account Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Policy Administration"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local File Permissions"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restricts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Access Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1531"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Unlock Account"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UnlockAccount"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Access Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1531"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "NTDS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "NTDS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1539"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1539"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1142"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1142"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Cookies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Cookies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Authentication Cache Invalidation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Account Locking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Video Surveillance"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Physical Access Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Video Surveillance"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Digital Camera"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Digital Camera"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Video Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1125"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VideoSurveillance"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DigitalCamera"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DigitalCamera"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "installs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Inhibit System Recovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1490"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1490"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Time Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-run"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-run"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "IIS Components"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Add-ins"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Add-ins"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Browser Extension"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1176"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BrowserExtension"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1176"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stored Procedure"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Client Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Host Software Binary"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1554"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ClientApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1554"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Software Dependencies and Development Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1195.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Supply Chain Compromise"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Software Supply Chain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1195.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Supply Chain Compromise"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "installs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MMC"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "runs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Compiler"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#runs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Update"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "updates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Time Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-run"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#updates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-run"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Hashing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Registry Key Deletion"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Registry Key Deletion"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Windows Registry Key"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Registry Key"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RegistryKeyDeletion"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistryKey"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistryKey"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Privilege Escalation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1068"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1068"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Hollowing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential API Hooking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Client Execution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1203"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1203"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential API Hooking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Defense Evasion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1211"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1211"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Hollowing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Forwarding Rule"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "configures"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Forwarding Rule"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DisableRemoteAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#configures"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Environment Variable"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessEnvironmentVariable"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "configures"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Environment Variable"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DisableRemoteAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#configures"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessEnvironmentVariable"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "configures"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DisableRemoteAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#configures"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email Rule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email Rule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "configures"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email Rule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DisableRemoteAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#configures"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "configures"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email Rule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DisableRemoteAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#configures"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Application Configuration Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable Windows Event Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disable Remote Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "configures"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable Windows Event Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DisableRemoteAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#configures"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "DNS Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "DNS Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "DNS Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "DNS Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "DNS Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "DNS Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "DNS Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "DNS Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "DNS Allowlisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "DNS Allowlisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSAllowlisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Access Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1219"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1219"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Symmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Fronting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Obfuscation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Stage Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1104"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1104"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Fallback Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encoding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1132"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1132"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1102"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1102"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1095"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1095"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mail Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-hop Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Transfer Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ingress Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1105"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1105"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Protocol Tunneling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1572"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1572"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Standard Port"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1571"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1571"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Cloud Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Unencrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Relay Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Remote Terminal Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RelayPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Lateral Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1570"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trusted Relationship"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1199"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Connection Attempt Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Database Query String Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Database Query String Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Query"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database Query"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "injects"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseQueryStringAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseQuery"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseQuery"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#injects"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Disk Formatting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disk Partitioning"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Partition Table"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Partition Table"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disk Structure Wipe"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1561.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Disk Wipe"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiskPartitioning"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PartitionTable"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PartitionTable"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1561.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1561"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Disk Formatting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disk Partitioning"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Partition Table"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Partition Table"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disk Content Wipe"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1561.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Disk Wipe"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiskPartitioning"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PartitionTable"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PartitionTable"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1561.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1561"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Disk Formatting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disk Formatting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Secondary Storage"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Storage"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Storage Object Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1619"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiskFormatting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SecondaryStorage"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudStorage"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1619"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Disk Formatting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disk Erasure"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "erases"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Secondary Storage"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Storage"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Storage Object Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1619"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiskErasure"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#erases"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SecondaryStorage"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudStorage"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1619"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Active Logical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Active Logical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Active Logical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Active Logical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Active Logical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firewall"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Network Device Firewall"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firewall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Active Logical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Delete Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Active Logical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Revert Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Taint Shared Content"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1080"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1080"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Replication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1091"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1091"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Elevated Execution with Prompt"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Parent PID Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ptrace System Calls"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asynchronous Procedure Call"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Doppelg\u00e4nging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Local Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Communication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1092"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1092"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Defacement"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1491.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defacement"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1491.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1491"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network File Share Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Network Shared Drive"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1039"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkFileShareResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1039"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Input Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Audio Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Audio Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1123"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AudioInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1123"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get Screen Capture"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screen Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1113"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetScreenCapture"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1113"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sharepoint"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1213.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data from Information Repositories"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Input Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Video Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Video Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1125"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VideoInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Confluence"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1213.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data from Information Repositories"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1025"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1025"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Input Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Keyboard Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keylogging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get System Network Config Value"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemNetworkConfigValue"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get Open Windows"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Window Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetOpenWindows"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Window Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get Running Processes"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Software Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1518.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Software Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetRunningProcesses"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get Running Processes"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Service Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetRunningProcesses"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Service Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Information Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1082"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1082"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Socket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateSocket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Copy Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CopyToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get System Config Value"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemConfigValue"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get Open Sockets"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Connections Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1049"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetOpenSockets"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1049"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get System Time"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Time Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1124"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemTime"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1124"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Time Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1124"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1124"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get System Config Value"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Query Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemConfigValue"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get Running Processes"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1057"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetRunningProcesses"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1057"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1057"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1057"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get System Time"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemTime"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Replication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1091"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1091"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Native API"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1106"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1106"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "NTDS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1539"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Read File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReadFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1142"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Input Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Keyboard Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keylogging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Cookies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Thread"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mavinject"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateThread"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Elevated Execution with Prompt"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Control Panel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compiled HTML File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compiled HTML File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network File Share Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "unmounts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Share Connection Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkFileShareResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#unmounts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Parent PID Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ptrace System Calls"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asynchronous Procedure Call"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Doppelg\u00e4nging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Transmission Scoping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Move File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MoveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Local Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Call"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Get System Time"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemTime"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration over USB"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1052.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Physical Medium"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1052.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1052"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "installs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "installs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Replication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1091"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1091"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Image File Execution Options Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Elevated Execution with Prompt"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Providers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Setuid and Setgid"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SID-History Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Startup Directory"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Startup Items"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Authentication Package"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Change Default File Association"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Monitors"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Support Provider"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain or Tenant Policy Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1484"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1484"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ShimDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Winlogon Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Communication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1092"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1092"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Inhibit System Recovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1490"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1490"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Inhibit System Recovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1490"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1490"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Inhibit System Recovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1490"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1490"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Audio Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Audio Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1123"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AudioInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1123"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Video Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Video Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1125"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VideoInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Digital Camera"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Video Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1125"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DigitalCamera"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Code Repository"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Code Repositories"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1213.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data from Information Repositories"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CodeRepository"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1025"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1025"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Keyboard Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keylogging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Node Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNodeInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Forwarding Rule"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Service Dashboard"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1538"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1538"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Location Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1614"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1614"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Software Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1518.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Software Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firewall Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Software Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1518.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Software Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirewallConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "queries"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Language Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1614.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Location Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#queries"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1614.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1614"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Service Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1526"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1526"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Query Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Storage"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Storage Object Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1619"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudStorage"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1619"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Group Policy Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1615"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1615"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Time Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-run"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-run"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Time Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-run"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-run"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Home Page"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Container Image"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Container Image"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Implant Internal Image"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1525"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImage"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImage"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1525"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Image File Execution Options Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Providers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "IIS Components"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "IIS Components"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Startup Directory"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Startup Items"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Node Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNodeInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Authentication Package"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Change Default File Association"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Conditional Access Policies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Add-ins"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Add-ins"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Add-ins"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Add-ins"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Add-ins"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Browser Extension"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1176"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BrowserExtension"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1176"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Browser Extension"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1176"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BrowserExtension"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1176"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Test"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Monitors"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Node Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNodeInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Support Provider"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ShimDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stored Procedure"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stored Procedure"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Client Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Host Software Binary"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1554"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ClientApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1554"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Client Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Host Software Binary"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1554"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ClientApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1554"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Winlogon Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Registry"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1112"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistry"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1112"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Software Dependencies and Development Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1195.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Supply Chain Compromise"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Software Dependencies and Development Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1195.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Supply Chain Compromise"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Replication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1091"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1091"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Hardware Supply Chain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1195.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Supply Chain Compromise"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Software Supply Chain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1195.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Supply Chain Compromise"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Software Supply Chain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1195.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Supply Chain Compromise"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "connects"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hardware Additions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1200"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#connects"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1200"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "installs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "installs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "MacOS Keychain"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MacOSKeychain"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials in Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password Store"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordStore"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Conditional Access Policies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Instance Metadata"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Instance Metadata API"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudInstanceMetadata"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Security Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Interception"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1111"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SecurityToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1111"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "In-memory Password Store"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#In-memoryPasswordStore"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Keyboard Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keylogging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Password Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemPasswordDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "In-memory Password Store"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Securityd Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#In-memoryPasswordStore"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Group Policy Preferences"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Password Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemPasswordDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Elevated Execution with Prompt"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Control Panel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Setuid and Setgid"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Cloud Firewall"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SID-History Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MMC"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MMC"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MMC"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "runs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Compiler"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#runs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "runs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Compiler"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#runs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Instance Metadata"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudInstanceMetadata"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Node Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNodeInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden File System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Conditional Access Policies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firewall Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify System Firewall"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirewallConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Cloud Resource Hierarchy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1666"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1666"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Environment Variable"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessEnvironmentVariable"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Registry Key"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistryKey"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email Rule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email Rule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Node Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firewall"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Network Device Firewall"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNodeInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firewall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Permissions Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1222"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1222"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Instance Metadata"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Delete Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudInstanceMetadata"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Node Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Delete Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNodeInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SIP and Trust Provider Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1553.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Subvert Trust Controls"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1553.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1553"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Cloud Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Instance Metadata"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Revert Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudInstanceMetadata"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Node Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Revert Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNodeInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain or Tenant Policy Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1484"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1484"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Configurations"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Safe Mode Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable Windows Event Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration Component"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable Windows Event Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationComponent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Registry"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1112"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistry"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1112"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Time Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-run"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-run"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Time Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-run"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-run"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware Component Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration over USB"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1052.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Physical Medium"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1052.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1052"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Desktop Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Service Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1563"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SSH"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Lateral Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1570"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Access Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1219"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1219"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Symmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Fronting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Obfuscation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Stage Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1104"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1104"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Fallback Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encoding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1132"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1132"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1102"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1102"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1095"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1095"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mail Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-hop Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Transfer Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ingress Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1105"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1105"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Protocol Tunneling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1572"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1572"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Standard Port"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1571"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1571"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Reflection Amplification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Endpoint Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Direct Network Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transmitted Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Browser Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1185"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1185"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trusted Relationship"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1199"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "RPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kerberoasting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Exfiltration"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1020"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1020"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Transfer Size Limits"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1030"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1030"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1029"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1029"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Cloud Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Unencrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Other Network Medium"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Remote Terminal Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "RPC Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "RPC Traffic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "RPC Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "RPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kerberoasting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RPCTrafficAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Excision"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Providers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Authentication Package"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Change Default File Association"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Monitors"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Support Provider"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Winlogon Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Software Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1518.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Software Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Providers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Authentication Package"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Change Default File Association"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Test"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Monitors"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Support Provider"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Winlogon Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Control Panel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Registry Key"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistryKey"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SIP and Trust Provider Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1553.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Subvert Trust Controls"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1553.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1553"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File Section"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Resource Fork"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Resource Forking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileFormatVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileSection"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ResourceFork"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Format Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File Section"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Resource Fork"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Resource Forking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileFormatVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileSection"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ResourceFork"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Safe Mode Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Variable Initialization"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Source Code Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Variable Initialization"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Subroutine"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stored Procedure"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VariableInitialization"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Subroutine"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Pinning"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Pinning"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificatePinning"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Certificate"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Certificate"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "installs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Inhibit System Recovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1490"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1490"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Time Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-run"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-run"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Container Image"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Container Image"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Implant Internal Image"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1525"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImage"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImage"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1525"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "IIS Components"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Add-ins"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Add-ins"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Browser Extension"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1176"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BrowserExtension"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1176"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stored Procedure"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Client Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Host Software Binary"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1554"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ClientApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1554"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Software Dependencies and Development Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1195.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Supply Chain Compromise"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Software Supply Chain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1195.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Supply Chain Compromise"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "installs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MMC"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "runs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Compiler"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#runs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Time Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-run"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-run"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Access Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1531"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Certificate-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Certificate"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Certificate"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Substitution"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "installs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Inhibit System Recovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1490"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1490"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Time Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-run"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-run"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "IIS Components"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Add-ins"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Add-ins"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Browser Extension"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1176"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BrowserExtension"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1176"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stored Procedure"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Client Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Host Software Binary"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1554"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ClientApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1554"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Software Dependencies and Development Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1195.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Supply Chain Compromise"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Software Supply Chain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1195.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Supply Chain Compromise"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "installs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MMC"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "runs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Compiler"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#runs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Software Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Time Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-run"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-run"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local File Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Call Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Access Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1219"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1219"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Symmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Fronting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Obfuscation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Stage Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1104"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1104"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Fallback Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encoding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1132"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1132"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1102"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1102"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1095"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1095"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mail Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-hop Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Transfer Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ingress Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1105"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1105"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Protocol Tunneling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1572"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1572"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Standard Port"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1571"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1571"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Cloud Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Unencrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Outbound Traffic Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Remote Terminal Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundTrafficFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disk Partitioning"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Partition Table"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Partition Table"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disk Structure Wipe"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1561.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Disk Wipe"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiskPartitioning"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PartitionTable"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PartitionTable"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1561.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1561"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disk Partitioning"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Partition Table"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Partition Table"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disk Content Wipe"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1561.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Disk Wipe"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiskPartitioning"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PartitionTable"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PartitionTable"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1561.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1561"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Removal"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRemoval"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disk Formatting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Secondary Storage"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Storage"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Storage Object Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1619"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiskFormatting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SecondaryStorage"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudStorage"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1619"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disk Erasure"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "erases"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Secondary Storage"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Storage"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Storage Object Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1619"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiskErasure"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#erases"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SecondaryStorage"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudStorage"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1619"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Removal"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRemoval"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Registry Key Deletion"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Windows Registry Key"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Registry Key"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RegistryKeyDeletion"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistryKey"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistryKey"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Session"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "RDP Session"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Desktop Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Session"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RDPSession"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Session"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Session"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Service Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1563"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Session"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteSession"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Session"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "SSH Session"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SSH Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1563.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Service Session Hijacking"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Session"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SSHSession"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Session"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "RDP Session"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RDP Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1563.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Service Session Hijacking"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Session"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RDPSession"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Session"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "SSH Session"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SSH"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Session"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SSHSession"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Session"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Login Session"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Session"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LoginSession"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Session"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Session"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1133"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Session"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkSession"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1133"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Session"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Session"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1133"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Session"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkSession"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1133"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Session"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Login Session"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trusted Relationship"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1199"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Session"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LoginSession"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Session Termination"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Session"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Login Session"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionTermination"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Session"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LoginSession"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local Account Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local Account Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local Account Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local Account Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local Account Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Local Account Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "installs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Inhibit System Recovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1490"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1490"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Time Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-run"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-run"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Container Image Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Container Image"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Container Image"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Implant Internal Image"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1525"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImage"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImage"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1525"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "IIS Components"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Add-ins"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Add-ins"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Browser Extension"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1176"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BrowserExtension"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1176"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Service Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stored Procedure"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Client Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Host Software Binary"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1554"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ClientApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1554"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Software Dependencies and Development Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1195.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Supply Chain Compromise"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Software Supply Chain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1195.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Supply Chain Compromise"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "installs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MMC"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "runs"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Compiler"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#runs"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Asset Vulnerability Enumeration"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Software"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Time Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-run"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Based Checks"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1497.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Virtualization/Sandbox Evasion"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-run"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "NTDS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1539"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1142"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Cookies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Revocation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevocation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Email"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Email"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreEmail"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Email"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Email"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreEmail"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Email"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Email"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreEmail"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Email"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Email"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreEmail"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "IPC Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "IPC Traffic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IPCTrafficAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "IPC Traffic Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "IPC Traffic Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IPCTrafficAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "System Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Vulnerability Assessment"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "evaluates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Digital System"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Legacy System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Downgrade Attack"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemVulnerabilityAssessment"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DigitalSystem"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LegacySystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Write Protection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Hardware-based Write Protection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Secondary Storage"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Storage"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Storage Object Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1619"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedWriteProtection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SecondaryStorage"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudStorage"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1619"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Integrity Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Desktop Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Service Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1563"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SSH"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Lateral Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1570"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Access Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1219"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1219"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Symmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Fronting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Obfuscation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Stage Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1104"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1104"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Fallback Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encoding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1132"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1132"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1102"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1102"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1095"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1095"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mail Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-hop Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Transfer Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ingress Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1105"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1105"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Protocol Tunneling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1572"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1572"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Standard Port"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1571"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1571"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Reflection Amplification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Endpoint Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Direct Network Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transmitted Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Browser Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1185"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1185"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trusted Relationship"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1199"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "RPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kerberoasting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Exfiltration"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1020"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1020"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Transfer Size Limits"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1030"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1030"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1029"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1029"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Cloud Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Unencrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Other Network Medium"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Signature Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Remote Terminal Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficSignatureAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Node Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Node Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNodeInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Node Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Node Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNodeInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Node Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Node Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNodeInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Node Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Node Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNodeInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Node Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Node Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firewall"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Network Device Firewall"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNodeInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firewall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Node Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Node Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Delete Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNodeInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Node Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Node Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Revert Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNodeInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Parent PID Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asynchronous Procedure Call"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Doppelg\u00e4nging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Window Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Service Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Information Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1082"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1082"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Time Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1124"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1124"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1057"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1057"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Control Panel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compiled HTML File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Parent PID Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-invoke"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asynchronous Procedure Call"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Doppelg\u00e4nging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Spawn Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Create Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "invokes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Taint Shared Content"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1080"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1080"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Defacement"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1491.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defacement"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1491.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1491"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network File Share Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Network Shared Drive"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1039"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkFileShareResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1039"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sharepoint"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1213.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data from Information Repositories"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Confluence"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1213.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data from Information Repositories"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "NTDS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1539"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1142"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Cookies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network File Share Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "unmounts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Share Connection Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkFileShareResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#unmounts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy User Credential"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy File"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Firmware Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Behavior Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareBehaviorAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Firmware Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Behavior Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareBehaviorAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Firmware Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Behavior Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareBehaviorAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Firmware Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Behavior Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareBehaviorAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Firmware Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Behavior Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareBehaviorAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Firmware Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Behavior Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareBehaviorAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Firmware Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Firmware Behavior Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FirmwareBehaviorAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Replication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1091"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1091"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Communication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1092"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1092"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Input Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Audio Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Audio Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1123"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AudioInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1123"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Input Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Video Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Video Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1125"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VideoInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1025"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1025"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Input Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Keyboard Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keylogging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Replication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1091"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1091"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Input Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Keyboard Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keylogging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "IO Port Restriction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration over USB"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1052.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Physical Medium"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1052.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1052"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Host Shutdown"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Host Reboot"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "terminates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Image File Execution Options Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Elevated Execution with Prompt"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Code Repository"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Code Repositories"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1213.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data from Information Repositories"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CodeRepository"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "queries"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Language Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1614.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Location Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#queries"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1614.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1614"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Query Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Image File Execution Options Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Add-ins"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Registry"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1112"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistry"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1112"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "MacOS Keychain"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MacOSKeychain"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials in Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password Store"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordStore"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "In-memory Password Store"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#In-memoryPasswordStore"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Password Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemPasswordDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "In-memory Password Store"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Securityd Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#In-memoryPasswordStore"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Password Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemPasswordDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Elevated Execution with Prompt"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MMC"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden File System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Data Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Registry"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Registry"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1112"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistry"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1112"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reverse Resolution IP Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reverse Resolution IP Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReverseResolutionIPDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Reverse Resolution IP Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Reverse Resolution IP Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReverseResolutionIPDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firewall"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Network Device Firewall"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firewall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Delete Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Revert Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Taint Shared Content"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1080"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1080"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Defacement"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1491.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defacement"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1491.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1491"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network File Share Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Network Shared Drive"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1039"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkFileShareResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1039"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sharepoint"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1213.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data from Information Repositories"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Confluence"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1213.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data from Information Repositories"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Object"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy Network Resource"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "spoofs"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network File Share Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "unmounts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Share Connection Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkFileShareResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#unmounts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Standalone Honeynet"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Decoy Environment"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Deceive"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Decoy Environment"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "manages"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Decoy Artifact"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Decoy Artifact"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Information Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1082"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyEnvironment"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#manages"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyArtifact"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyArtifact"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1082"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Direct Physical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Direct Physical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Direct Physical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Direct Physical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Direct Physical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firewall"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Network Device Firewall"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firewall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Direct Physical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Delete Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Direct Physical Link Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Revert Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Trusted Library"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Source Code Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Trusted Library"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Subroutine"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stored Procedure"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TrustedLibrary"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Subroutine"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "NTDS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1539"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1142"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Cookies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Certificate"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Certificate"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Firmware Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Firmware Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmwareVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Firmware Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Firmware Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmwareVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Firmware Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Firmware Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "ROMMONkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmwareVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Firmware Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Firmware Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Firmware"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmwareVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Access Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1531"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Particle Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Replication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1091"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1091"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Particle Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Communication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1092"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1092"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Particle Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Audio Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Audio Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1123"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AudioInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1123"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Particle Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Video Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Video Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1125"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VideoInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Particle Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Digital Camera"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Video Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1125"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DigitalCamera"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Particle Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1025"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1025"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Particle Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Keyboard Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keylogging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Particle Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Storage"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Storage Object Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1619"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudStorage"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1619"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Particle Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Replication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1091"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1091"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Particle Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Hardware Supply Chain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1195.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Supply Chain Compromise"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Particle Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "connects"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hardware Additions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1200"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#connects"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1200"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Particle Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Security Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Interception"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1111"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SecurityToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1111"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Particle Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Keyboard Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keylogging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Particle Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration over USB"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1052.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Physical Medium"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1052.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1052"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "NTDS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1539"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1142"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Cookies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Setuid and Setgid"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SID-History Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain or Tenant Policy Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1484"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1484"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Group Policy Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1615"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1615"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Conditional Access Policies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Conditional Access Policies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Group Policy Preferences"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Setuid and Setgid"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SID-History Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Conditional Access Policies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firewall"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Network Device Firewall"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firewall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firewall"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Network Device Firewall"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firewall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Permissions Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1222"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1222"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Delete Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Delete Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Physical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Revert Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Logical Link Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Revert Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Mapping"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Policy Mapping"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "maps"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain or Tenant Policy Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1484"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficPolicyMapping"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1484"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Carving"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Carving"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File Transfer Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Lateral Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1570"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileCarving"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileTransferNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Carving"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Carving"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File Transfer Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Transfer Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileCarving"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileTransferNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Replication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1091"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1091"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Communication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1092"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1092"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Audio Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Audio Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1123"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AudioInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1123"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Video Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Video Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1125"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VideoInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Digital Camera"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Video Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1125"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DigitalCamera"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1025"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1025"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Keyboard Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keylogging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Storage"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Storage Object Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1619"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudStorage"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1619"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Replication Through Removable Media"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1091"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1091"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compromise Hardware Supply Chain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1195.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Supply Chain Compromise"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "connects"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hardware Additions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1200"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#connects"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1200"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Security Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Interception"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1111"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SecurityToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1111"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Keyboard Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keylogging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Radiation Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Hardware Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Removable Media Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration over USB"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1052.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Physical Medium"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RadiationHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1052.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1052"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Desktop Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Service Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1563"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SSH"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Lateral Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1570"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Access Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1219"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1219"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Symmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Fronting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Obfuscation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Stage Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1104"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1104"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Fallback Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encoding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1132"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1132"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1102"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1102"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1095"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1095"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mail Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-hop Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Transfer Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ingress Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1105"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1105"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Protocol Tunneling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1572"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1572"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Standard Port"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1571"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1571"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Reflection Amplification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Endpoint Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Direct Network Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transmitted Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Browser Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1185"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1185"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trusted Relationship"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1199"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "RPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kerberoasting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Exfiltration"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1020"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1020"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Transfer Size Limits"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1030"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1030"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1029"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1029"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Cloud Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Unencrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Other Network Medium"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Protocol Metadata Anomaly Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Remote Terminal Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProtocolMetadataAnomalyDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemDaemonMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemDaemonMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemDaemonMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemDaemonMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemDaemonMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemDaemonMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemDaemonMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TokenBinding"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TokenBinding"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TokenBinding"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TokenBinding"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Access Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1531"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "use-limits"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#use-limits"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "NTDS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "NTDS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TokenBinding"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TokenBinding"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TokenBinding"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TokenBinding"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "use-limits"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#use-limits"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1539"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1539"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1142"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1142"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Strong Password Policy"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "use-limits"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#use-limits"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Cookies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Cookies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Pinning"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificatePinning"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Certificate"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Certificate"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Certificate"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Certificate"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TokenBinding"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TokenBinding"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TokenBinding"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token Binding"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TokenBinding"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Change Default Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ChangeDefaultPassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Bootloader Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Bootloader Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "authenticates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootloaderAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Bootloader Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Bootloader Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "authenticates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Boot Loader"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootloaderAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Self-Modification Detection"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Shadow Stack Comparisons"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Shadow Stack Comparisons"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ShadowStackComparisons"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Shadow Stack Comparisons"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Shadow Stack Comparisons"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Privilege Escalation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1068"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ShadowStackComparisons"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1068"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Shadow Stack Comparisons"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Shadow Stack Comparisons"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Client Execution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1203"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ShadowStackComparisons"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1203"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Shadow Stack Comparisons"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Shadow Stack Comparisons"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ShadowStackComparisons"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Shadow Stack Comparisons"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Shadow Stack Comparisons"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stack Frame"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Defense Evasion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1211"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ShadowStackComparisons"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1211"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Scheduled Job Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Scheduled Job Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Job Schedule"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Job Schedule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJobAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Scheduled Job Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Scheduled Job Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Job Schedule"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Job Schedule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJobAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Scheduled Job Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Scheduled Job Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Job Schedule"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Job Schedule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJobAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Scheduled Job Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Scheduled Job Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Job Schedule"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Job Schedule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Masquerade Task or Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJobAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Disk Erasure"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disk Formatting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Secondary Storage"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Storage"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Storage Object Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1619"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiskFormatting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SecondaryStorage"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudStorage"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1619"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Disk Erasure"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disk Erasure"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "erases"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Secondary Storage"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Storage"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Storage Object Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1619"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiskErasure"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#erases"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SecondaryStorage"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudStorage"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1619"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSA Secrets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Process Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Lineage Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Providers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Setuid and Setgid"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SID-History Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Startup Directory"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Startup Items"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Authentication Package"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Change Default File Association"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Monitors"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Support Provider"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain or Tenant Policy Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1484"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1484"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ShimDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Winlogon Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Inhibit System Recovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1490"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1490"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Forwarding Rule"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Service Dashboard"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1538"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1538"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Location Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1614"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1614"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Software Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1518.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Software Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firewall Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Software Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1518.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Software Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirewallConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Service Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1526"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1526"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Group Policy Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1615"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1615"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Home Page"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Providers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Startup Directory"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Startup Items"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Authentication Package"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Change Default File Association"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Conditional Access Policies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Test"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Monitors"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Support Provider"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shim Database"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Shimming"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ShimDatabase"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Winlogon Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Conditional Access Policies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Instance Metadata"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Instance Metadata API"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudInstanceMetadata"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Group Policy Preferences"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Control Panel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Setuid and Setgid"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Cloud Firewall"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SID-History Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Instance Metadata"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudInstanceMetadata"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Conditional Access Policies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Firewall Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify System Firewall"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirewallConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Cloud Resource Hierarchy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1666"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1666"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Environment Variable"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessEnvironmentVariable"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Registry Key"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistryKey"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email Rule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email Rule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Email Hiding Rules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Control Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Permissions Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1222"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1222"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Instance Metadata"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Delete Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudInstanceMetadata"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SIP and Trust Provider Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1553.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Subvert Trust Controls"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1553.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1553"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Cloud Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Instance Metadata"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Revert Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudInstanceMetadata"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Group Policy"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain or Tenant Policy Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1484"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1484"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Configurations"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Safe Mode Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable Windows Event Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Asset Inventory"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Model"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Configuration Inventory"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "inventories"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Configuration Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration Component"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable Windows Event Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationComponent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Internal Structure Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Document File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "File Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Emulated File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "URL Reputation Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "URL Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URLReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "URL Reputation Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "URL Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URLReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "URL Reputation Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "URL Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URLReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "URL Reputation Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Identifier Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "URL Reputation Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "URL"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URLReputationAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#URL"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Windows Event Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Command History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Operational Process Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Event Log"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperationalProcessMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EventLog"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Desktop Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Service Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1563"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SSH"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Lateral Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1570"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Access Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1219"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1219"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Symmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Fronting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Obfuscation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Stage Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1104"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1104"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Fallback Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encoding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1132"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1132"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1102"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1102"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1095"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1095"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mail Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-hop Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Transfer Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ingress Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1105"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1105"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Protocol Tunneling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1572"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1572"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Standard Port"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1571"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1571"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Reflection Amplification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Endpoint Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Direct Network Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transmitted Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Browser Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1185"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1185"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trusted Relationship"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1199"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "RPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kerberoasting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Exfiltration"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1020"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1020"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Transfer Size Limits"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1030"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1030"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1029"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1029"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Cloud Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Unencrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Other Network Medium"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Per Host Download-Upload Ratio Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Remote Terminal Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PerHostDownload-UploadRatioAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Proxy-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Taint Shared Content"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1080"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1080"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Proxy-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Proxy-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Proxy-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Defacement"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1491.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defacement"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1491.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1491"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Proxy-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network File Share Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Network Shared Drive"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1039"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkFileShareResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1039"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Proxy-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Proxy-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sharepoint"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1213.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data from Information Repositories"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Proxy-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Confluence"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1213.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data from Information Repositories"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Proxy-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Proxy-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Proxy-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Proxy-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Proxy-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Proxy-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Proxy-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Proxy-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Proxy-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Proxy-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network File Share Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "unmounts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Share Connection Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkFileShareResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#unmounts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Proxy-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Proxy-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "use-limits"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#use-limits"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "NTDS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "NTDS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "use-limits"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#use-limits"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1539"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1539"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1142"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1142"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "use-limits"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#use-limits"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Cookies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Cookies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Certificate"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Certificate"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Input Device Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Input Device Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Input Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Audio Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Audio Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1123"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDeviceAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AudioInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1123"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Input Device Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Input Device Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Input Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Video Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Video Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1125"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDeviceAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VideoInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Input Device Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Input Device Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Input Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Keyboard Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keylogging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDeviceAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Input Device Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Input Device Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Input Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Keyboard Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keylogging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDeviceAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hierarchical Domain Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "DNS Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "DNS Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Hierarchical Domain Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "DNS Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "DNS Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Providers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Authentication Package"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Change Default File Association"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Monitors"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Support Provider"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Winlogon Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Software Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1518.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Software Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Time Providers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Netsh Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Authentication Package"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Change Default File Association"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Test"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Monitors"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Support Provider"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Winlogon Helper DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Control Panel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Registry Key"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistryKey"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SIP and Trust Provider Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1553.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Subvert Trust Controls"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1553.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1553"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Database Record"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Safe Mode Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseRecord"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Quarantine"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "quarantines"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "use-limits"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#use-limits"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "NTDS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "NTDS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "use-limits"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#use-limits"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1539"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1539"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1142"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1142"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "use-limits"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#use-limits"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Cookies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Cookies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Taint Shared Content"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1080"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1080"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Defacement"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1491.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defacement"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1491.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1491"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network File Share Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Network Shared Drive"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1039"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkFileShareResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1039"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sharepoint"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1213.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data from Information Repositories"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Confluence"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1213.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data from Information Repositories"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network File Share Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "unmounts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Share Connection Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkFileShareResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#unmounts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Remote File Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Access Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1531"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "NTDS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1539"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1142"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Cookies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Token-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Token-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Token-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Token-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Access Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1531"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "NTDS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Token-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Token-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Token-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Token-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1539"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1142"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Password Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Cookies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Certificate-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Certificate"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Certificate-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Certificate"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Certificate"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Token-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Token-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Temporary Elevated Cloud Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Token-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Token-based Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Token-basedAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Multi-factor Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Agent Authentication"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "strengthens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Default User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Default Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AgentAuthentication"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Domain Logic Validation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Source Code Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Domain Logic Validation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "validates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Subroutine"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stored Procedure"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainLogicValidation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#validates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Subroutine"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Network Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Network Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreNetworkAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Network Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Network Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreNetworkAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Network Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Network Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreNetworkAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Network Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Network Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreNetworkAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Network Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Network Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Delete Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreNetworkAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Restore Network Access"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Restore Access"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Restore"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Restore Network Access"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "restores"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Revert Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreNetworkAccess"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restores"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Taint Shared Content"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1080"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1080"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Defacement"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1491.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defacement"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1491.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1491"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network File Share Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Network Shared Drive"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1039"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkFileShareResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1039"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sharepoint"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1213.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data from Information Repositories"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Confluence"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1213.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data from Information Repositories"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Directory Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Message Transfer Agent"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Remote Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "abuses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Factor Authentication Request Generation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1621"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteAuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#abuses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1621"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Security Account Manager"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Network Resource Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Resource"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network File Share Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "unmounts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Share Connection Removal"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResourceAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkFileShareResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#unmounts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Endpoint-based Web Server Access Mediation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Access Mediation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Web Session Access Mediation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "isolates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Authentication Service"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebSessionAccessMediation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplicationProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Credential Scrubbing"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Source Code Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Scrubbing"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Subroutine"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Stored Procedure"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SQL Stored Procedures"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialScrubbing"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Subroutine"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Desktop Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Service Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1563"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "SSH"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1021.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Remote Services"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Lateral Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1570"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Access Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1219"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1219"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Symmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Fronting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Obfuscation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-Stage Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1104"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1104"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Fallback Channels"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encoding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1132"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1132"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1102"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1102"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1095"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1095"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mail Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Multi-hop Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet File Transfer Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Transfer Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Ingress Tool Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1105"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1105"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Protocol Tunneling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1572"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1572"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Non-Standard Port"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1571"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1571"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "External Proxy"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1090.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Proxy"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Reflection Amplification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Service Exhaustion Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1499.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Endpoint Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Direct Network Flood"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1498.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Network Denial of Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transmitted Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Browser Session Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1185"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1185"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "enumerates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1087.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Discovery"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enumerates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Email Delegate Permissions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Account"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1136.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create Account"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Global User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Roles"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Inbound Internet Mail Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trusted Relationship"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1199"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "NTDS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Multicast Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LLMNR/NBT-NS Poisoning and SMB Relay"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1539"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1142"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "RPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kerberoasting"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Cookies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "DHCP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DHCP Spoofing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1557.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Adversary-in-the-Middle"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Local Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Local User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "TFTP Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "TFTP Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1542.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Pre-OS Boot"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet IPC Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "BITS Jobs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1197"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Port Knocking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Domain Account Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Domain User Account"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Domain Accounts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1078.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Valid Accounts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Compromise Scope Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "CMSTP"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Traffic Signaling"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1205"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Exfiltration"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1020"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1020"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Transfer Size Limits"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1030"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1030"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Transfer"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1029"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1029"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Cloud Storage"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Unencrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Internet Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Other Network Medium"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Web Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "User Behavior Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Geolocation Logon Pattern Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet Encrypted Remote Terminal Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-produce"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration to Code Repository"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1567.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Web Service"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Startup Directory"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Startup Items"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Privilege Escalation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1068"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1068"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Session Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserSessionInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemDaemonMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Scheduled Job Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Job Schedule"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Job Schedule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJobAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemDaemonMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Hollowing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Input Device Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Input Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Audio Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Audio Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1123"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDeviceAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AudioInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1123"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential API Hooking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Input Device Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Input Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Video Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Video Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1125"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDeviceAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VideoInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Input Device Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Input Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Keyboard Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keylogging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDeviceAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Startup Directory"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Startup Items"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Session Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserSessionInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemDaemonMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Scheduled Job Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Job Schedule"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Job Schedule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJobAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Persistence Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemDaemonMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Client Execution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1203"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1203"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Software Deployment Tool"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemDaemonMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Scheduled Job Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Job Schedule"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Job Schedule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJobAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Scheduled Job"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemDaemonMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential API Hooking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Input Device Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Input Device"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Keyboard Input Device"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keylogging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDeviceAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Portal Capture"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential Management System"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Virtualization Software"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Defense Evasion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1211"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1211"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services Registry Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Daemon Monitoring"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Process"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemDaemonMonitoring"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Firewall"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Disable or Modify Network Device Firewall"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firewall"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Scheduled Job Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Job Schedule"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Job Schedule"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Masquerade Task or Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJobAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Delete Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Endpoint Health Beacon"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "monitors"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Network Node"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Host"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Revert Cloud Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1578.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Cloud Compute Infrastructure"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Host"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1578"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Memory Boundary Tracking"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Hollowing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MemoryBoundaryTracking"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "System Init Configuration"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Configuration Init Database Record"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "disables"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Safe Mode Boot"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitConfiguration"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "User Session Init Config Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserSessionInitConfigAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Services File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Service Binary Verification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "verifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Service Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Executable Installer File Permissions Weakness"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Operating System Monitoring"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Monitoring"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "System File Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFileAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation of Remote Services"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1210"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Privilege Escalation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1068"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Privilege Escalation Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1068"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Hollowing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential API Hooking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploit Public-Facing Application"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1190"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Drive-by Compromise"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1189"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Initial Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Client Execution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1203"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1203"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Credential Access"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1212"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential API Hooking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1056.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Input Capture"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mavinject"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exploitation for Defense Evasion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1211"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1211"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Reflective Code Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1620"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1620"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Application Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Process Segment Execution Prevention"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "neutralizes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Process Segment"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Process Code Segment"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Process Hollowing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Forward Resolution Domain Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Forward Resolution Domain Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DNS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ForwardResolutionDomainDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Forward Resolution Domain Denylisting"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Isolation"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Forward Resolution Domain Denylisting"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "blocks"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Outbound Internet DNS Lookup Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Resolution"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1568"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ForwardResolutionDomainDenylisting"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Disk Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disk Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Storage"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Cloud Storage"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cloud Storage Object Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1619"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiskEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Storage"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudStorage"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1619"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Disk Encryption"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Platform Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Disk Encryption"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Storage"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Storage"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden File System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiskEncryption"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Storage"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Storage"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Removal"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRemoval"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Email Removal"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Mail Server"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Transport Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRemoval"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Object Eviction"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Evict"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "File Eviction"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Internal Spearphishing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1534"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Lateral Movement Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Asymmetric Cryptography"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1573.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Encrypted Channel"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Protocols"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Layer Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1071"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Command and Control Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Command And Control"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "encrypts"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data Encrypted for Impact"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1486"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impact Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1486"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Stored Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Runtime Data Manipulation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1565.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Impact"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Automated Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1119"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Data Staging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1074.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Data Staged"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Custom Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Custom Method"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Data from Local System"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Collection Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Library"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Archive File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Archive via Utility"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1560.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Archive Collected Data"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "reads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Local Email Collection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1114.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Email Collection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Collection"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-execute"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Network Configuration Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1016"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Remote System Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1018"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "System Owner/User Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1033"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File and Directory Discovery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1083"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Discovery Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Discovery"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Office Template Macros"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Kernel Modules and Extensions"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unix Shell Configuration Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Screensaver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Re-opened Applications"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Component Object Model Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.015"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppInit DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.010"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Daemon"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Application Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Plist Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Emond"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Symbolic Link"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shortcut Modification"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Startup Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Registry Run Keys / Startup Folder"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LC_LOAD_DYLIB Addition"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "LSASS Driver"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1547.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Autostart Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Web Script File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Shell"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1505.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Server Software Component"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "System Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "RC Scripts"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Login Hook"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Network Init Script File Resource"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Network Logon Script"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launch Agent"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "PowerShell Profile Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "PowerShell Profile"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.013"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Outlook Forms"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1137.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Office Application Startup"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Trap"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Logon Script (Windows)"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1037.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Boot or Logon Initialization Scripts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "AppCert DLLs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Systemd Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1543.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Create or Modify System Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Attachment"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Email"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing Link"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Spearphishing via Service"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1566.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Phishing"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Initial Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Deployment Tools"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1072"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Malicious File"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1204.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "User Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Command and Scripting Interpreter"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1059"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Launchd"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1053.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Scheduled Task/Job"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials In Files"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Windows Shortcut File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forced Authentication"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1187"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Database File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credentials from Web Browsers"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1555.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credentials from Password Stores"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Filesystem"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Authentication Certificates"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1649"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1649"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Command History Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Shell History"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "executes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Bypass User Account Control"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Log File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Clear Linux or Mac System Logs"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Space after Filename"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VDSO Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Microsoft HTML Application"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Mshta"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Compile After Delivery"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Run Virtual Instance"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Compiler Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "MSBuild"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1127.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Trusted Developer Utilities Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "obfuscates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Software Packing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rundll32"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1218.011"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "System Binary Proxy Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL Side-Loading"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Property List File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Window"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Deobfuscate/Decode Files or Information"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1140"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Thread Execution Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Filter DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dylib Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "COR_PROFILER"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.012"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kernel Module"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rootkit"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1014"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Impair Command History Logging"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1562.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Impair Defenses"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Object File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-add"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Portable Executable Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Unquoted Path"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Invalid Code Signature"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Proc Memory"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.009"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DLL"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by PATH Environment Variable"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Sudo and Sudo Caching"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1548.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Abuse Elevation Control Mechanism"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Script"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "interprets"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "XSL Script Processing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1220"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "loads"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic-link Library Injection"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1055.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Process Injection"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "deletes"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "File Deletion"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1070.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Indicator Removal"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rename Legitimate Utilities"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Match Legitimate Resource Name or Location"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1036.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Masquerading"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable Binary"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Binary Padding"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1027.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Obfuscated Files or Information"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Office Application File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "VBA Stomping"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.007"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "User Init Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Hidden Users"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1564.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hide Artifacts"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Dynamic Linker Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Shared Library File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Operating System Configuration File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-modify"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Pluggable Authentication Modules"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1556.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Modify Authentication Process"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Executable File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Path Interception by Search Order Hijacking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1574.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Hijack Execution Flow"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over C2 Channel"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1041"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "filters"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Content Rebuild"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Content Filtering"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Isolate"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Content Modification"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "modifies"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "File"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Certificate File"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-transfer"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1048.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Exfiltration Over Alternative Protocol"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Exfiltration"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Accessibility Features"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation Event Subscription"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1546.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Event Triggered Execution"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Windows Management Instrumentation"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1047"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Execution Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Execution"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Credential Stuffing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "DCSync"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.006"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Network Traffic Analysis"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Detect"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Administrative Network Activity Analysis"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "analyzes"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Intranet Administrative Network Traffic"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "produces"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Rogue Domain Controller"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1207"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Defense Evasion Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Lateral Movement"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Privilege Escalation"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "creates"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Additional Cloud Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1098.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Account Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Persistence"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "use-limits"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#use-limits"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Guessing"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "NTDS"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket Granting Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Golden Ticket"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-access"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Kerberos Ticket"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "may-create"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal or Forge Kerberos Tickets"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1558"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "/etc/passwd and /etc/shadow"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.008"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1528"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Cached Domain Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1003.005"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "OS Credential Dumping"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "use-limits"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#use-limits"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Spraying"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Steal Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1539"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Encrypted Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Keychain"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1142"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Unsecured Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1552"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "regenerates"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordRotation"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "One-time Password"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "use-limits"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#use-limits"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Password"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "accesses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Password Cracking"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1110.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Brute Force"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Credential Access Technique"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "true",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "forges"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Cookies"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1606.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Forge Web Credentials"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Credential Access"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1606"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Token Impersonation/Theft"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "uses"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Application Access Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.001"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Session Cookie"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "adds"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Web Session Cookie"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1550.004"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Use Alternate Authentication Material"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Create Process with Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.002"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      },
      {
        "query_def_tech_label": {
          "type": "literal",
          "value": "Password Rotation"
        },
        "top_def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_tactic_label": {
          "type": "literal",
          "value": "Harden"
        },
        "def_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "def_tech_label": {
          "type": "literal",
          "value": "Credential Hardening"
        },
        "def_artifact_rel_label": {
          "type": "literal",
          "value": "hardens"
        },
        "def_artifact_label": {
          "type": "literal",
          "value": "Credential"
        },
        "off_artifact_label": {
          "type": "literal",
          "value": "Access Token"
        },
        "off_artifact_rel_label": {
          "type": "literal",
          "value": "copies"
        },
        "off_tech_label": {
          "type": "literal",
          "value": "Make and Impersonate Token"
        },
        "off_tech_id": {
          "type": "literal",
          "value": "T1134.003"
        },
        "off_tech_parent_label": {
          "type": "literal",
          "value": "Access Token Manipulation"
        },
        "off_tech_parent_is_toplevel": {
          "type": "literal",
          "value": "false",
          "datatype": "http://www.w3.org/2001/XMLSchema#boolean"
        },
        "off_tactic_rel_label": {
          "type": "literal",
          "value": "enables"
        },
        "off_tactic_label": {
          "type": "literal",
          "value": "Defense Evasion"
        },
        "def_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"
        },
        "def_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "def_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialHardening"
        },
        "def_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"
        },
        "def_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"
        },
        "off_artifact": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"
        },
        "off_artifact_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies"
        },
        "off_tech": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"
        },
        "off_tech_parent": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"
        },
        "off_tactic_rel": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables"
        },
        "off_tactic": {
          "type": "uri",
          "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"
        }
      }
    ]
  }
}